---
title: "CURUPIRA — paper by Sousa et al. (2026) — summary and ideas"
description: "Open guardrail models such as Llama-Guard and ShieldGemma are trained mostly on English. 19 references."
authors: ["Rogério Sousa", "William Alberto Cruz-Castañeda", "José Roberto Homeli Silva", "Marcellus Amadeus"]
year: 2026
venue: "Proceedings of the 17th International Conference on Computational Processing of Portuguese (PROPOR 2026) - Vol. 1"
source: "https://aclanthology.org/2026.propor-1.107/"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/sousa-2026-curupira-clever-guard-harm-linguistic/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/sousa-2026-curupira-clever-guard-harm-linguistic/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/28/) / CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese

# CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese

**Authors:** Rogério Sousa, William Alberto Cruz-Castañeda, José Roberto Homeli Silva and [Marcellus Amadeus](https://md.research.elamur.ai/free/en/authors/marcellus-amadeus/) · **Year:** 2026 · **Venue:** [Proceedings of the 17th International Conference on Computational Processing of Portuguese (PROPOR 2026) - Vol. 1](https://md.research.elamur.ai/free/en/venues/propor/) ([International Conference on Computational Processing of Portuguese 2026](https://md.research.elamur.ai/free/en/venues/propor/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.propor-1.107/) · [PDF](https://aclanthology.org/2026.propor-1.107.pdf)

## Summary
Open guardrail models such as Llama-Guard and ShieldGemma are trained mostly on English. They tend to misjudge harmful prompts in other languages, especially when slang or culture-specific phrasing hides malicious intent. Even multilingual options like Qwen3Guard share this weakness. The authors address the gap for Brazilian Portuguese with Curupira, a family of guard models built in three stages. First, they adapt ShieldGemma's four-category safety taxonomy to the Lusophone context. Second, they generate a balanced synthetic dataset of safe and unsafe prompts with a pipeline based on AI-Assisted Red-Teaming (AART). Third, they apply supervised fine-tuning. The adapted models are compared with the original Qwen3Guard and ShieldGemma checkpoints on five Brazilian Portuguese social-media benchmarks and one English chatbot dataset. Fine-tuning raised macro F1 for every model. Curupira-7B scored best overall, Curupira-3B came close, and the 0.6B variant also gained substantially. Performance drops were small and limited to specific datasets, and the English benchmark showed little sign of forgetting. The study suggests that compact, locally adapted open guardrails are a realistic option for Portuguese-language LLMs such as Sabiá or Tucano.

## Key points
- **Training data:** The synthetic Portuguese safety corpus contains 17,513 labeled examples in balanced safe/unsafe pairs, split 80/10/10. It was generated through three prompting layers:
  - conceptual mapping of native terms and slang,
  - structural typology for syntactic variety,
  - instance synthesis.
- **Taxonomy:** The categories come from ShieldGemma: Hate Speech, Harassment, Sexually Explicit, and Dangerous Content.
- **Evaluation benchmarks:**
  - Portuguese: ToxSyn-PT, OLID-BR, TuPy-E, HateBR, and ToLD-BR.
  - English: Toxic-Chat, used to check cross-lingual degradation and catastrophic forgetting.
- **Baselines and comparability:** The baselines are ShieldGemma 1 (2B, 9B) and Qwen3Guard-Gen (0.6B, 4B, 8B). To compare them on a binary scale, Qwen's Unsafe and Controversial outputs were both counted as violations, and F1 was the main metric.
- **Fine-tuning setup:** Training restricted the loss to completion tokens, ran in bfloat16, capped sequences at 8,192 tokens, and optimized with a paged variant of AdamW. Five configurations varied learning rate, epochs, and warmup.
- **Stated limitations:** The work relies on synthetic data, includes no human evaluation, and covers only text classification.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works

## Cite

Cite as: Rogério Sousa, William Alberto Cruz-Castañeda, José Roberto Homeli Silva and Marcellus Amadeus. 2026. CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese. Proceedings of the 17th International Conference on Computational Processing of Portuguese (PROPOR 2026) - Vol. 1.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{sousa2026curupira,
  title = {{CURUPIRA: Clever guard for harm and linguistic prompt mitigation in Brazilian Portuguese}},
  author = {Rogério Sousa, William Alberto Cruz-Castañeda, José Roberto Homeli Silva and Marcellus Amadeus},
  booktitle = {Proceedings of the 17th International Conference on Computational Processing of Portuguese (PROPOR 2026) - Vol. 1},
  year = {2026},
  url = {https://aclanthology.org/2026.propor-1.107/}
}
```

- [← previous Curriculum Learning based Hierarchical Scoring and Analysis Framework for Question Answering Task Evaluation](https://md.research.elamur.ai/free/en/papers/wu-2026-curriculum-learning-based-hierarchical-scoring/)
- [next → Curvature aware gradient projection prototype meta learning framework improves low resource English dialect recognition](https://md.research.elamur.ai/free/en/papers/chen-2026-curvature-aware-gradient-projection-prototype/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/28/)

## References

19 references, 5 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Somnath Banerjee, Pratyush Chatterjee, Shanu Kumar, Sayan Layek, Parag Agrawal, Rima Hazra, and Animesh Mukherjee. 2025. Attributional Safety Failures in Large Language Models under Code-Mixed Perturbations. arXiv preprint. ArXiv:2505.14469 [cs] version: 2. — [arXiv:2505.14469](https://arxiv.org/abs/2505.14469) [find](https://scholar.google.com/scholar?q=Somnath+Banerjee%2C+Pratyush+Chatterjee%2C+Shanu+Kumar%2C+Sayan+Layek%2C+Parag+Agrawal%2C+Rima+Hazra%2C+and+Animesh+Mukherjee%2E+2025%2E+Attributional+Safety+Failures+in+Large+Language+Models+under+Code%2DMixed+Perturb)
2. Lavish Bansal and Naman Mishra. 2025. CREST: Universal Safety Guardrails Through Cluster-Guided Cross-Lingual Transfer. arXiv preprint. ArXiv:2512.02711 [cs] version: 1. [find](https://scholar.google.com/scholar?q=Lavish+Bansal+and+Naman+Mishra%2E+2025%2E+CREST%3A+Universal+Safety+Guardrails+Through+Cluster%2DGuided+Cross%2DLingual+Transfer%2E+arXiv+preprint%2E+ArXiv%3A2512%2E02711+%5Bcs%5D+version%3A+1%2E)
3. Iago Alves Brito, Julia Soares Dollis, Fernanda Bufon Färber, Diogo Fernandes Costa Silva, and Arlindo Rodrigues Galvão Filho. 2025. ToxSyn-PT: A Large-Scale Synthetic Dataset for Hate Speech Detection in Portuguese. arXiv preprint. ArXiv:2506.10245 [cs]. — [arXiv:2506.10245](https://arxiv.org/abs/2506.10245) [find](https://scholar.google.com/scholar?q=Iago+Alves+Brito%2C+Julia+Soares+Dollis%2C+Fernanda+Bufon+F%C3%A4rber%2C+Diogo+Fernandes+Costa+Silva%2C+and+Arlindo+Rodrigues+Galv%C3%A3o+Filho%2E+2025%2E+ToxSyn%2DPT%3A+A+Large%2DScale+Synthetic+Dataset+for+Hate+Speech+Detectio)
4. William Alberto Cruz-Castañeda and Marcellus Amadeus. 2025. Large languages models in brazilian portuguese: A chronological survey. Journal of the Brazilian Computer Society, 31(1):1167–1186. [https://soberania.ai](https://soberania.ai) [↗](https://soberania.ai)
5. Amanda da Silva Oliveira, Thiago de Carvalho Ce-cote, João Paulo Reis Alvarenga, Vander Luis de Souza Freitas, and Eduardo José da Silva Luz. 2024. Toxic speech detection in portuguese: A comparative study of large language models. In Proceedings of the 16th International Conference on Computational… [find](https://scholar.google.com/scholar?q=Amanda+da+Silva+Oliveira%2C+Thiago+de+Carvalho+Ce%2Dcote%2C+Jo%C3%A3o+Paulo+Reis+Alvarenga%2C+Vander+Luis+de+Souza+Freitas%2C+and+Eduardo+Jos%C3%A9+da+Silva+Luz%2E+2024%2E+Toxic+speech+detection+in+portuguese%3A+A+comparative+)
6. Shaona Ghosh, Prasoon Varshney, Erick Galinkin, and Christopher Parisien. 2024. Aegis: Online adaptive ai content safety moderation with ensemble of llm experts. arXiv preprint arXiv:2404.05993. — [arXiv:2404.05993](https://arxiv.org/abs/2404.05993) [find](https://scholar.google.com/scholar?q=Shaona+Ghosh%2C+Prasoon+Varshney%2C+Erick+Galinkin%2C+and+Christopher+Parisien%2E+2024%2E+Aegis%3A+Online+adaptive+ai+content+safety+moderation+with+ensemble+of+llm+experts%2E+arXiv+preprint+arXiv%3A2404%2E05993%2E+%E2%80%94+%5Bar)
7. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. 2024. [Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms](https://md.research.elamur.ai/free/en/papers/han-2024-wildguard-open-one-stop-moderation/). Advances in Neural Information Processing Systems, 37:8093–8131.
8. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and 1 others. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
9. João Augusto Leite, Diego Silva, Kalina Bontcheva, and Carolina Scarton. 2020. Toxic language detection in social media for brazilian portuguese: New dataset and multilingual analysis. In Proceedings of the 1st conference of the Asia-Pacific chapter of the association for computational linguistics a… [find](https://scholar.google.com/scholar?q=Jo%C3%A3o+Augusto+Leite%2C+Diego+Silva%2C+Kalina+Bontcheva%2C+and+Carolina+Scarton%2E+2020%2E+Toxic+language+detection+in+social+media+for+brazilian+portuguese%3A+New+dataset+and+multilingual+analysis%2E+In+Proceedings+)
10. Zi Lin, Zihan Wang, Yongqi Tong, Yangkun Wang, Yuxin Guo, Yujia Wang, and Jingbo Shang. 2023. [ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversation](https://md.research.elamur.ai/free/en/papers/lin-2023-toxicchat-unveiling-hidden-challenges-toxicity/). arXiv preprint. ArXiv:2310.17389 [cs].
11. Felipe Oliveira, Victoria Reis, and Nelson Ebecken. 2023. Tupy-e: detecting hate speech in brazilian portuguese social media with a novel dataset and comprehensive analysis of models. arXiv preprint arXiv:2312.17704. — [arXiv:2312.17704](https://arxiv.org/abs/2312.17704) [find](https://scholar.google.com/scholar?q=Felipe+Oliveira%2C+Victoria+Reis%2C+and+Nelson+Ebecken%2E+2023%2E+Tupy%2De%3A+detecting+hate+speech+in+brazilian+portuguese+social+media+with+a+novel+dataset+and+comprehensive+analysis+of+models%2E+arXiv+preprint+a)
12. Fábio Perez and Ian Ribeiro. 2022. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). Preprint, arXiv:2211.09527.
13. Bhaktipriya Radharapu, Kevin Robinson, Lora Aroyo, and Preethi Lahoti. 2023. AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications. arXiv preprint. ArXiv:2311.08592 [cs]. [find](https://scholar.google.com/scholar?q=Bhaktipriya+Radharapu%2C+Kevin+Robinson%2C+Lora+Aroyo%2C+and+Preethi+Lahoti%2E+2023%2E+AART%3A+AI%2DAssisted+Red%2DTeaming+with+Diverse+Data+Generation+for+New+LLM%2Dpowered+Applications%2E+arXiv+preprint%2E+ArXiv%3A2311%2E085)
14. Douglas Trajano, Rafael H. Bordini, and Renata Vieira. 2024. OLID-BR: offensive language identification dataset for Brazilian Portuguese. Language Resources and Evaluation, 58(4):1263–1289. [find](https://scholar.google.com/scholar?q=Douglas+Trajano%2C+Rafael+H%2E+Bordini%2C+and+Renata+Vieira%2E+2024%2E+OLID%2DBR%3A+offensive+language+identification+dataset+for+Brazilian+Portuguese%2E+Language+Resources+and+Evaluation%2C+58%284%29%3A1263%E2%80%931289%2E)
15. Francielle Vargas, Isabelle Carvalho, Fabiana Rodrigues de Góes, Thiago Pardo, and Fabrício Benevenuto. 2022. HateBR: A large expert annotated corpus of Brazilian Instagram comments for offensive language and hate speech detection. In Proceedings of the Thirteenth Language Resources and Evaluation C… [find](https://scholar.google.com/scholar?q=Francielle+Vargas%2C+Isabelle+Carvalho%2C+Fabiana+Rodrigues+de+G%C3%B3es%2C+Thiago+Pardo%2C+and+Fabr%C3%ADcio+Benevenuto%2E+2022%2E+HateBR%3A+A+large+expert+annotated+corpus+of+Brazilian+Instagram+comments+for+offensive+lang)
16. Laura Weidinger, Jonathan Uesato, Maribeth Rauh, Conor Griffin, Po-Sen Huang, John Mellor, Amelia Glaese, Myra Cheng, Borja Balle, Atoosa Kasirzadeh, Courtney Biles, Sasha Brown, Zac Kenton, Will Hawkins, Tom Stepleton, Abeba Birhane, Lisa Anne Hendricks, Laura Rimell, William Isaac, and 4 others. 2… [find](https://scholar.google.com/scholar?q=Laura+Weidinger%2C+Jonathan+Uesato%2C+Maribeth+Rauh%2C+Conor+Griffin%2C+Po%2DSen+Huang%2C+John+Mellor%2C+Amelia+Glaese%2C+Myra+Cheng%2C+Borja+Balle%2C+Atoosa+Kasirzadeh%2C+Courtney+Biles%2C+Sasha+Brown%2C+Zac+Kenton%2C+Will+Hawk)
17. Yahan Yang, Soham Dan, Dan Roth, and Insup Lee. 2024. Benchmarking llm guardrails in handling multilingual toxicity. arXiv preprint arXiv:2410.22153. [find](https://scholar.google.com/scholar?q=Yahan+Yang%2C+Soham+Dan%2C+Dan+Roth%2C+and+Insup+Lee%2E+2024%2E+Benchmarking+llm+guardrails+in+handling+multilingual+toxicity%2E+arXiv+preprint+arXiv%3A2410%2E22153%2E)
18. Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, Olivia Sturman, and Oscar Wahltinez. 2024. Shield-Gemma: Generative AI Content Moderation Based on Gemma. arXiv preprint. ArXiv:2407.21772 [cs]. — [arXiv:2407.21772](https://arxiv.org/abs/2407.21772) [find](https://scholar.google.com/scholar?q=Wenjun+Zeng%2C+Yuchi+Liu%2C+Ryan+Mullins%2C+Ludovic+Peran%2C+Joe+Fernandez%2C+Hamza+Harkous%2C+Karthik+Narasimhan%2C+Drew+Proud%2C+Piyush+Kumar%2C+Bhaktipriya+Radharapu%2C+Olivia+Sturman%2C+and+Oscar+Wahltinez%2E+2024%2E+Shiel)
19. Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jingren Zhou, Junyang Lin, Baosong Yang, Chen Cheng, Jialong Tang, Jiandong Jiang, Jianwei Zhang, Jijie Xu, Ming Yan, Minmin Sun, Pei Zhang, and 24 others. 2025. [Qwen3Guard Technical Report](https://md.research.elamur.ai/free/en/papers/zhao-2025-qwen3guard-technical-report/). ArXiv:251…

*Updated 1 November 2026*